Beware: Your Coding Agent Trips the Same EDR Rules Built to Catch Attackers

Sophos telemetry from June 2026 shows Claude Code, Cursor, and Codex setting off credential-access, LOLBin, and persistence rules on Windows endpoints — because to a behavioral engine, benign agent work is indistinguishable from an intrusion. Here's what fired, why allowlisting is the wrong fix, and how to scope it safely.

Raccontata dadev.to